A02 Cryptographic Failures - OWASP Top 10:2021 (2024)

Factors

CWEs Mapped	Max Incidence Rate	Avg Incidence Rate	Avg Weighted Exploit	Avg Weighted Impact	Max Coverage	Avg Coverage	Total Occurrences	Total CVEs
29	46.44%	4.49%	7.29	6.81	79.33%	34.85%	233,788	3,075

Overview

Shifting up one position to #2, previously known as Sensitive DataExposure, which is more of a broad symptom rather than a root cause,the focus is on failures related to cryptography (or lack thereof).Which often lead to exposure of sensitive data. Notable Common Weakness Enumerations (CWEs) includedare CWE-259: Use of Hard-coded Password, CWE-327: Broken or RiskyCrypto Algorithm, and CWE-331 Insufficient Entropy.

Description

The first thing is to determine the protection needs of data in transitand at rest. For example, passwords, credit card numbers, healthrecords, personal information, and business secrets require extraprotection, mainly if that data falls under privacy laws, e.g., EU'sGeneral Data Protection Regulation (GDPR), or regulations, e.g.,financial data protection such as PCI Data Security Standard (PCI DSS).For all such data:

Is any data transmitted in clear text? This concerns protocols such as HTTP, SMTP, FTP also using TLS upgrades like STARTTLS. External internet traffic is hazardous. Verify all internal traffic, e.g., between load balancers, web servers, or back-end systems.
Are any old or weak cryptographic algorithms or protocols used either by default or in older code?
Are default crypto keys in use, weak crypto keys generated or re-used, or is proper key management or rotation missing? Are crypto keys checked into source code repositories?
Is encryption not enforced, e.g., are any HTTP headers (browser) security directives or headers missing?
Is the received server certificate and the trust chain properly validated?
Are initialization vectors ignored, reused, or not generated sufficiently secure for the cryptographic mode of operation? Is an insecure mode of operation such as ECB in use? Is encryption used when authenticated encryption is more appropriate?
Are passwords being used as cryptographic keys in absence of a password base key derivation function?
Is randomness used for cryptographic purposes that was not designed to meet cryptographic requirements? Even if the correct function is chosen, does it need to be seeded by the developer, and if not, has the developer over-written the strong seeding functionality built into it with a seed that lacks sufficient entropy/unpredictability?
Are deprecated hash functions such as MD5 or SHA1 in use, or are non-cryptographic hash functions used when cryptographic hash functions are needed?
Are deprecated cryptographic padding methods such as PKCS number 1 v1.5 in use?
Are cryptographic error messages or side channel information exploitable, for example in the form of padding oracle attacks?

See ASVS Crypto (V7), Data Protection (V9), and SSL/TLS (V10)

How to Prevent

Do the following, at a minimum, and consult the references:

Classify data processed, stored, or transmitted by an application. Identify which data is sensitive according to privacy laws, regulatory requirements, or business needs.
Don't store sensitive data unnecessarily. Discard it as soon as possible or use PCI DSS compliant tokenization or even truncation. Data that is not retained cannot be stolen.
See Also
Cryptographic Failures Real-Life Examples | QAwerk Cryptographic Failures: Understanding the Pitfalls and Impact What is a cryptosystem? Definition from WhatIs.com 8 Types of Attack in Cryptography
Make sure to encrypt all sensitive data at rest.
Ensure up-to-date and strong standard algorithms, protocols, and keys are in place; use proper key management.
Encrypt all data in transit with secure protocols such as TLS with forward secrecy (FS) ciphers, cipher prioritization by the server, and secure parameters. Enforce encryption using directives like HTTP Strict Transport Security (HSTS).
Disable caching for response that contain sensitive data.
Apply required security controls as per the data classification.
Do not use legacy protocols such as FTP and SMTP for transporting sensitive data.
Store passwords using strong adaptive and salted hashing functions with a work factor (delay factor), such as Argon2, scrypt, bcrypt or PBKDF2.
Initialization vectors must be chosen appropriate for the mode of operation. For many modes, this means using a CSPRNG (cryptographically secure pseudo random number generator). For modes that require a nonce, then the initialization vector (IV) does not need a CSPRNG. In all cases, the IV should never be used twice for a fixed key.
Always use authenticated encryption instead of just encryption.
Keys should be generated cryptographically randomly and stored in memory as byte arrays. If a password is used, then it must be converted to a key via an appropriate password base key derivation function.
Ensure that cryptographic randomness is used where appropriate, and that it has not been seeded in a predictable way or with low entropy. Most modern APIs do not require the developer to seed the CSPRNG to get security.
Avoid deprecated cryptographic functions and padding schemes, such as MD5, SHA1, PKCS number 1 v1.5 .
Verify independently the effectiveness of configuration and settings.

Example Attack Scenarios

Scenario #1: An application encrypts credit card numbers in adatabase using automatic database encryption. However, this data isautomatically decrypted when retrieved, allowing a SQL injection flaw toretrieve credit card numbers in clear text.

Scenario #2: A site doesn't use or enforce TLS for all pages orsupports weak encryption. An attacker monitors network traffic (e.g., atan insecure wireless network), downgrades connections from HTTPS toHTTP, intercepts requests, and steals the user's session cookie. Theattacker then replays this cookie and hijacks the user's (authenticated)session, accessing or modifying the user's private data. Instead of theabove they could alter all transported data, e.g., the recipient of amoney transfer.

Scenario #3: The password database uses unsalted or simple hashes tostore everyone's passwords. A file upload flaw allows an attacker toretrieve the password database. All the unsalted hashes can be exposedwith a rainbow table of pre-calculated hashes. Hashes generated bysimple or fast hash functions may be cracked by GPUs, even if they weresalted.

References

OWASP Proactive Controls: Protect Data Everywhere
See Also
Cryptographic Failures – What is it?
OWASP Application Security Verification Standard (V7, 9, 10)
OWASP Cheat Sheet: Transport Layer Protection
OWASP Cheat Sheet: User Privacy Protection
OWASP Cheat Sheet: Password Storage
OWASP Cheat Sheet: Cryptographic Storage
OWASP Cheat Sheet: HSTS
OWASP Testing Guide: Testing for weak cryptography